Overview

overview

10

Static

static

3

e789d2a96e...18.exe

windows7-x64

10

e789d2a96e...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08-04-2024 13:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e789d2a96e11cb833fdad0fb7da47ca3_JaffaCakes118.exe

  • Size

    359KB

  • MD5

    e789d2a96e11cb833fdad0fb7da47ca3

  • SHA1

    df9873f1547a59812a1b91c8130126a89b2d14a5

  • SHA256

    08a240445fb0572dc54a8582c43ef11991374f85ddd2de9e28dfed54331e0455

  • SHA512

    b2c165ca7dbec7a534be35bd86b4acaa08610298a054247185892f88acab9decdf550faaed3f613a44520e5c31536a661886e7e261da2d1fed9095202a1c8b63

  • SSDEEP

    6144:QBntsMYs/UW4gqwTqQxjVitawx1az++B7pkU7MTth1Y03u8AvWc:QTdx/URwHPQjaz+wMTr1Y0+8AvWc

Score
10/10
persistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e789d2a96e11cb833fdad0fb7da47ca3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e789d2a96e11cb833fdad0fb7da47ca3_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\ProgramData\kA11901MoPiP11901\kA11901MoPiP11901.exe
      "C:\ProgramData\kA11901MoPiP11901\kA11901MoPiP11901.exe" "C:\Users\Admin\AppData\Local\Temp\e789d2a96e11cb833fdad0fb7da47ca3_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:2276

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\kA11901MoPiP11901\kA11901MoPiP11901.exe
    Filesize

    359KB

    MD5

    e94198ecd3ccc5442f2ad485fe9de27b

    SHA1

    bb7989f2e642648cddd0a1319c23133a13e90fa2

    SHA256

    38cb9e4eae43e3627822199f67d0aa190e2ea58a18ea8609666ac9dca800eaab

    SHA512

    c5fd93c0a517749d7be5eabd1f79d14a173368b3e4069e83c520e80cbe41d39fb695a24f50e4e617ff37307029d9ab0b2e8e5e827fead9ecfcacbed8a9054365

    Download Submit
  • memory/1276-0-0x00000000003E0000-0x00000000003E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1276-1-0x0000000000400000-0x00000000004D1000-memory.dmp
    Filesize

    836KB

    Download
  • memory/1276-10-0x0000000000400000-0x00000000004D1000-memory.dmp
    Filesize

    836KB

    Download
  • memory/1276-30-0x0000000000400000-0x00000000004D1000-memory.dmp
    Filesize

    836KB

    Download
  • memory/2276-36-0x0000000000400000-0x00000000004D1000-memory.dmp
    Filesize

    836KB

    Download
  • memory/2276-38-0x0000000000400000-0x00000000004D1000-memory.dmp
    Filesize

    836KB

    Download